Commit 7a520219 authored by Eric Biggers's avatar Eric Biggers Committed by Greg Kroah-Hartman

fscrypt: remove broken support for detecting keyring key revocation

commit 1b53cf98 upstream.

Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again.  This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.

This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired.  Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory.  Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem.  In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.

In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches.  But this is a hard problem, and for now this bug must be fixed.

This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y).  Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.

Fixes: b7236e21 ("ext4 crypto: reorganize how we store keys in the inode")
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
Acked-by: default avatarMichael Halcrow <mhalcrow@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 573341eb
...@@ -88,8 +88,6 @@ void ext4_free_crypt_info(struct ext4_crypt_info *ci) ...@@ -88,8 +88,6 @@ void ext4_free_crypt_info(struct ext4_crypt_info *ci)
if (!ci) if (!ci)
return; return;
if (ci->ci_keyring_key)
key_put(ci->ci_keyring_key);
crypto_free_ablkcipher(ci->ci_ctfm); crypto_free_ablkcipher(ci->ci_ctfm);
kmem_cache_free(ext4_crypt_info_cachep, ci); kmem_cache_free(ext4_crypt_info_cachep, ci);
} }
...@@ -111,7 +109,7 @@ void ext4_free_encryption_info(struct inode *inode, ...@@ -111,7 +109,7 @@ void ext4_free_encryption_info(struct inode *inode,
ext4_free_crypt_info(ci); ext4_free_crypt_info(ci);
} }
int _ext4_get_encryption_info(struct inode *inode) int ext4_get_encryption_info(struct inode *inode)
{ {
struct ext4_inode_info *ei = EXT4_I(inode); struct ext4_inode_info *ei = EXT4_I(inode);
struct ext4_crypt_info *crypt_info; struct ext4_crypt_info *crypt_info;
...@@ -128,22 +126,15 @@ int _ext4_get_encryption_info(struct inode *inode) ...@@ -128,22 +126,15 @@ int _ext4_get_encryption_info(struct inode *inode)
char mode; char mode;
int res; int res;
if (ei->i_crypt_info)
return 0;
if (!ext4_read_workqueue) { if (!ext4_read_workqueue) {
res = ext4_init_crypto(); res = ext4_init_crypto();
if (res) if (res)
return res; return res;
} }
retry:
crypt_info = ACCESS_ONCE(ei->i_crypt_info);
if (crypt_info) {
if (!crypt_info->ci_keyring_key ||
key_validate(crypt_info->ci_keyring_key) == 0)
return 0;
ext4_free_encryption_info(inode, crypt_info);
goto retry;
}
res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION, res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION,
EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, EXT4_XATTR_NAME_ENCRYPTION_CONTEXT,
&ctx, sizeof(ctx)); &ctx, sizeof(ctx));
...@@ -166,7 +157,6 @@ int _ext4_get_encryption_info(struct inode *inode) ...@@ -166,7 +157,6 @@ int _ext4_get_encryption_info(struct inode *inode)
crypt_info->ci_data_mode = ctx.contents_encryption_mode; crypt_info->ci_data_mode = ctx.contents_encryption_mode;
crypt_info->ci_filename_mode = ctx.filenames_encryption_mode; crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
crypt_info->ci_ctfm = NULL; crypt_info->ci_ctfm = NULL;
crypt_info->ci_keyring_key = NULL;
memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor, memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
sizeof(crypt_info->ci_master_key)); sizeof(crypt_info->ci_master_key));
if (S_ISREG(inode->i_mode)) if (S_ISREG(inode->i_mode))
...@@ -206,7 +196,6 @@ int _ext4_get_encryption_info(struct inode *inode) ...@@ -206,7 +196,6 @@ int _ext4_get_encryption_info(struct inode *inode)
keyring_key = NULL; keyring_key = NULL;
goto out; goto out;
} }
crypt_info->ci_keyring_key = keyring_key;
if (keyring_key->type != &key_type_logon) { if (keyring_key->type != &key_type_logon) {
printk_once(KERN_WARNING printk_once(KERN_WARNING
"ext4: key type must be logon\n"); "ext4: key type must be logon\n");
...@@ -253,16 +242,13 @@ int _ext4_get_encryption_info(struct inode *inode) ...@@ -253,16 +242,13 @@ int _ext4_get_encryption_info(struct inode *inode)
ext4_encryption_key_size(mode)); ext4_encryption_key_size(mode));
if (res) if (res)
goto out; goto out;
memzero_explicit(raw_key, sizeof(raw_key));
if (cmpxchg(&ei->i_crypt_info, NULL, crypt_info) != NULL) {
ext4_free_crypt_info(crypt_info);
goto retry;
}
return 0;
if (cmpxchg(&ei->i_crypt_info, NULL, crypt_info) == NULL)
crypt_info = NULL;
out: out:
if (res == -ENOKEY) if (res == -ENOKEY)
res = 0; res = 0;
key_put(keyring_key);
ext4_free_crypt_info(crypt_info); ext4_free_crypt_info(crypt_info);
memzero_explicit(raw_key, sizeof(raw_key)); memzero_explicit(raw_key, sizeof(raw_key));
return res; return res;
......
...@@ -2330,23 +2330,11 @@ static inline void ext4_fname_free_filename(struct ext4_filename *fname) { } ...@@ -2330,23 +2330,11 @@ static inline void ext4_fname_free_filename(struct ext4_filename *fname) { }
/* crypto_key.c */ /* crypto_key.c */
void ext4_free_crypt_info(struct ext4_crypt_info *ci); void ext4_free_crypt_info(struct ext4_crypt_info *ci);
void ext4_free_encryption_info(struct inode *inode, struct ext4_crypt_info *ci); void ext4_free_encryption_info(struct inode *inode, struct ext4_crypt_info *ci);
int _ext4_get_encryption_info(struct inode *inode);
#ifdef CONFIG_EXT4_FS_ENCRYPTION #ifdef CONFIG_EXT4_FS_ENCRYPTION
int ext4_has_encryption_key(struct inode *inode); int ext4_has_encryption_key(struct inode *inode);
static inline int ext4_get_encryption_info(struct inode *inode) int ext4_get_encryption_info(struct inode *inode);
{
struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info;
if (!ci ||
(ci->ci_keyring_key &&
(ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
(1 << KEY_FLAG_REVOKED) |
(1 << KEY_FLAG_DEAD)))))
return _ext4_get_encryption_info(inode);
return 0;
}
static inline struct ext4_crypt_info *ext4_encryption_info(struct inode *inode) static inline struct ext4_crypt_info *ext4_encryption_info(struct inode *inode)
{ {
......
...@@ -78,7 +78,6 @@ struct ext4_crypt_info { ...@@ -78,7 +78,6 @@ struct ext4_crypt_info {
char ci_filename_mode; char ci_filename_mode;
char ci_flags; char ci_flags;
struct crypto_ablkcipher *ci_ctfm; struct crypto_ablkcipher *ci_ctfm;
struct key *ci_keyring_key;
char ci_master_key[EXT4_KEY_DESCRIPTOR_SIZE]; char ci_master_key[EXT4_KEY_DESCRIPTOR_SIZE];
}; };
......
...@@ -92,7 +92,6 @@ static void f2fs_free_crypt_info(struct f2fs_crypt_info *ci) ...@@ -92,7 +92,6 @@ static void f2fs_free_crypt_info(struct f2fs_crypt_info *ci)
if (!ci) if (!ci)
return; return;
key_put(ci->ci_keyring_key);
crypto_free_ablkcipher(ci->ci_ctfm); crypto_free_ablkcipher(ci->ci_ctfm);
kmem_cache_free(f2fs_crypt_info_cachep, ci); kmem_cache_free(f2fs_crypt_info_cachep, ci);
} }
...@@ -113,7 +112,7 @@ void f2fs_free_encryption_info(struct inode *inode, struct f2fs_crypt_info *ci) ...@@ -113,7 +112,7 @@ void f2fs_free_encryption_info(struct inode *inode, struct f2fs_crypt_info *ci)
f2fs_free_crypt_info(ci); f2fs_free_crypt_info(ci);
} }
int _f2fs_get_encryption_info(struct inode *inode) int f2fs_get_encryption_info(struct inode *inode)
{ {
struct f2fs_inode_info *fi = F2FS_I(inode); struct f2fs_inode_info *fi = F2FS_I(inode);
struct f2fs_crypt_info *crypt_info; struct f2fs_crypt_info *crypt_info;
...@@ -129,18 +128,12 @@ int _f2fs_get_encryption_info(struct inode *inode) ...@@ -129,18 +128,12 @@ int _f2fs_get_encryption_info(struct inode *inode)
char mode; char mode;
int res; int res;
if (fi->i_crypt_info)
return 0;
res = f2fs_crypto_initialize(); res = f2fs_crypto_initialize();
if (res) if (res)
return res; return res;
retry:
crypt_info = ACCESS_ONCE(fi->i_crypt_info);
if (crypt_info) {
if (!crypt_info->ci_keyring_key ||
key_validate(crypt_info->ci_keyring_key) == 0)
return 0;
f2fs_free_encryption_info(inode, crypt_info);
goto retry;
}
res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_ENCRYPTION, res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_ENCRYPTION,
F2FS_XATTR_NAME_ENCRYPTION_CONTEXT, F2FS_XATTR_NAME_ENCRYPTION_CONTEXT,
...@@ -159,7 +152,6 @@ int _f2fs_get_encryption_info(struct inode *inode) ...@@ -159,7 +152,6 @@ int _f2fs_get_encryption_info(struct inode *inode)
crypt_info->ci_data_mode = ctx.contents_encryption_mode; crypt_info->ci_data_mode = ctx.contents_encryption_mode;
crypt_info->ci_filename_mode = ctx.filenames_encryption_mode; crypt_info->ci_filename_mode = ctx.filenames_encryption_mode;
crypt_info->ci_ctfm = NULL; crypt_info->ci_ctfm = NULL;
crypt_info->ci_keyring_key = NULL;
memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor, memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor,
sizeof(crypt_info->ci_master_key)); sizeof(crypt_info->ci_master_key));
if (S_ISREG(inode->i_mode)) if (S_ISREG(inode->i_mode))
...@@ -197,7 +189,6 @@ int _f2fs_get_encryption_info(struct inode *inode) ...@@ -197,7 +189,6 @@ int _f2fs_get_encryption_info(struct inode *inode)
keyring_key = NULL; keyring_key = NULL;
goto out; goto out;
} }
crypt_info->ci_keyring_key = keyring_key;
BUG_ON(keyring_key->type != &key_type_logon); BUG_ON(keyring_key->type != &key_type_logon);
ukp = user_key_payload(keyring_key); ukp = user_key_payload(keyring_key);
if (ukp->datalen != sizeof(struct f2fs_encryption_key)) { if (ukp->datalen != sizeof(struct f2fs_encryption_key)) {
...@@ -230,17 +221,12 @@ int _f2fs_get_encryption_info(struct inode *inode) ...@@ -230,17 +221,12 @@ int _f2fs_get_encryption_info(struct inode *inode)
if (res) if (res)
goto out; goto out;
memzero_explicit(raw_key, sizeof(raw_key)); if (cmpxchg(&fi->i_crypt_info, NULL, crypt_info) == NULL)
if (cmpxchg(&fi->i_crypt_info, NULL, crypt_info) != NULL) { crypt_info = NULL;
f2fs_free_crypt_info(crypt_info);
goto retry;
}
return 0;
out: out:
if (res == -ENOKEY && !S_ISREG(inode->i_mode)) if (res == -ENOKEY && !S_ISREG(inode->i_mode))
res = 0; res = 0;
key_put(keyring_key);
f2fs_free_crypt_info(crypt_info); f2fs_free_crypt_info(crypt_info);
memzero_explicit(raw_key, sizeof(raw_key)); memzero_explicit(raw_key, sizeof(raw_key));
return res; return res;
......
...@@ -2149,7 +2149,6 @@ void f2fs_end_io_crypto_work(struct f2fs_crypto_ctx *, struct bio *); ...@@ -2149,7 +2149,6 @@ void f2fs_end_io_crypto_work(struct f2fs_crypto_ctx *, struct bio *);
/* crypto_key.c */ /* crypto_key.c */
void f2fs_free_encryption_info(struct inode *, struct f2fs_crypt_info *); void f2fs_free_encryption_info(struct inode *, struct f2fs_crypt_info *);
int _f2fs_get_encryption_info(struct inode *inode);
/* crypto_fname.c */ /* crypto_fname.c */
bool f2fs_valid_filenames_enc_mode(uint32_t); bool f2fs_valid_filenames_enc_mode(uint32_t);
...@@ -2170,18 +2169,7 @@ void f2fs_exit_crypto(void); ...@@ -2170,18 +2169,7 @@ void f2fs_exit_crypto(void);
int f2fs_has_encryption_key(struct inode *); int f2fs_has_encryption_key(struct inode *);
static inline int f2fs_get_encryption_info(struct inode *inode) int f2fs_get_encryption_info(struct inode *inode);
{
struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info;
if (!ci ||
(ci->ci_keyring_key &&
(ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) |
(1 << KEY_FLAG_REVOKED) |
(1 << KEY_FLAG_DEAD)))))
return _f2fs_get_encryption_info(inode);
return 0;
}
void f2fs_fname_crypto_free_buffer(struct f2fs_str *); void f2fs_fname_crypto_free_buffer(struct f2fs_str *);
int f2fs_fname_setup_filename(struct inode *, const struct qstr *, int f2fs_fname_setup_filename(struct inode *, const struct qstr *,
......
...@@ -79,7 +79,6 @@ struct f2fs_crypt_info { ...@@ -79,7 +79,6 @@ struct f2fs_crypt_info {
char ci_filename_mode; char ci_filename_mode;
char ci_flags; char ci_flags;
struct crypto_ablkcipher *ci_ctfm; struct crypto_ablkcipher *ci_ctfm;
struct key *ci_keyring_key;
char ci_master_key[F2FS_KEY_DESCRIPTOR_SIZE]; char ci_master_key[F2FS_KEY_DESCRIPTOR_SIZE];
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment